hxxps://wnsrc[.]plymouth[.]thetwilightzone[.]ru/

Analysis

max time kernel
208s
max time network
203s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/08/2024, 06:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://wnsrc.plymouth.thetwilightzone.ru/

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
48	camo.githubusercontent.com
49	camo.githubusercontent.com
50	camo.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2904	msedge.exe
2904	msedge.exe
1892	msedge.exe
1892	msedge.exe
2968	identity_helper.exe
2968	identity_helper.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 3252	1892	msedge.exe	83
PID 1892 wrote to memory of 3252	1892	msedge.exe	83
PID 1892 wrote to memory of 2148	1892	msedge.exe	84
PID 1892 wrote to memory of 2148	1892	msedge.exe	84
PID 1892 wrote to memory of 2148	1892	msedge.exe	84
PID 1892 wrote to memory of 2148	1892	msedge.exe	84
PID 1892 wrote to memory of 2148	1892	msedge.exe	84
PID 1892 wrote to memory of 2148	1892	msedge.exe	84
PID 1892 wrote to memory of 2148	1892	msedge.exe	84
PID 1892 wrote to memory of 2148	1892	msedge.exe	84
PID 1892 wrote to memory of 2148	1892	msedge.exe	84
PID 1892 wrote to memory of 2148	1892	msedge.exe	84
PID 1892 wrote to memory of 2148	1892	msedge.exe	84
PID 1892 wrote to memory of 2148	1892	msedge.exe	84
PID 1892 wrote to memory of 2148	1892	msedge.exe	84
PID 1892 wrote to memory of 2148	1892	msedge.exe	84
PID 1892 wrote to memory of 2148	1892	msedge.exe	84
PID 1892 wrote to memory of 2148	1892	msedge.exe	84
PID 1892 wrote to memory of 2148	1892	msedge.exe	84
PID 1892 wrote to memory of 2148	1892	msedge.exe	84
PID 1892 wrote to memory of 2148	1892	msedge.exe	84
PID 1892 wrote to memory of 2148	1892	msedge.exe	84
PID 1892 wrote to memory of 2148	1892	msedge.exe	84
PID 1892 wrote to memory of 2148	1892	msedge.exe	84
PID 1892 wrote to memory of 2148	1892	msedge.exe	84
PID 1892 wrote to memory of 2148	1892	msedge.exe	84
PID 1892 wrote to memory of 2148	1892	msedge.exe	84
PID 1892 wrote to memory of 2148	1892	msedge.exe	84
PID 1892 wrote to memory of 2148	1892	msedge.exe	84
PID 1892 wrote to memory of 2148	1892	msedge.exe	84
PID 1892 wrote to memory of 2148	1892	msedge.exe	84
PID 1892 wrote to memory of 2148	1892	msedge.exe	84
PID 1892 wrote to memory of 2148	1892	msedge.exe	84
PID 1892 wrote to memory of 2148	1892	msedge.exe	84
PID 1892 wrote to memory of 2148	1892	msedge.exe	84
PID 1892 wrote to memory of 2148	1892	msedge.exe	84
PID 1892 wrote to memory of 2148	1892	msedge.exe	84
PID 1892 wrote to memory of 2148	1892	msedge.exe	84
PID 1892 wrote to memory of 2148	1892	msedge.exe	84
PID 1892 wrote to memory of 2148	1892	msedge.exe	84
PID 1892 wrote to memory of 2148	1892	msedge.exe	84
PID 1892 wrote to memory of 2148	1892	msedge.exe	84
PID 1892 wrote to memory of 2904	1892	msedge.exe	85
PID 1892 wrote to memory of 2904	1892	msedge.exe	85
PID 1892 wrote to memory of 4120	1892	msedge.exe	86
PID 1892 wrote to memory of 4120	1892	msedge.exe	86
PID 1892 wrote to memory of 4120	1892	msedge.exe	86
PID 1892 wrote to memory of 4120	1892	msedge.exe	86
PID 1892 wrote to memory of 4120	1892	msedge.exe	86
PID 1892 wrote to memory of 4120	1892	msedge.exe	86
PID 1892 wrote to memory of 4120	1892	msedge.exe	86
PID 1892 wrote to memory of 4120	1892	msedge.exe	86
PID 1892 wrote to memory of 4120	1892	msedge.exe	86
PID 1892 wrote to memory of 4120	1892	msedge.exe	86
PID 1892 wrote to memory of 4120	1892	msedge.exe	86
PID 1892 wrote to memory of 4120	1892	msedge.exe	86
PID 1892 wrote to memory of 4120	1892	msedge.exe	86
PID 1892 wrote to memory of 4120	1892	msedge.exe	86
PID 1892 wrote to memory of 4120	1892	msedge.exe	86
PID 1892 wrote to memory of 4120	1892	msedge.exe	86
PID 1892 wrote to memory of 4120	1892	msedge.exe	86
PID 1892 wrote to memory of 4120	1892	msedge.exe	86
PID 1892 wrote to memory of 4120	1892	msedge.exe	86
PID 1892 wrote to memory of 4120	1892	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://wnsrc.plymouth.thetwilightzone.ru/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe8dff46f8,0x7ffe8dff4708,0x7ffe8dff4718
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,8648579301918253467,3922451565402224602,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,8648579301918253467,3922451565402224602,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,8648579301918253467,3922451565402224602,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8648579301918253467,3922451565402224602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8648579301918253467,3922451565402224602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,8648579301918253467,3922451565402224602,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,8648579301918253467,3922451565402224602,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8648579301918253467,3922451565402224602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8648579301918253467,3922451565402224602,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3860 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8648579301918253467,3922451565402224602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8648579301918253467,3922451565402224602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8648579301918253467,3922451565402224602,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,8648579301918253467,3922451565402224602,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3880 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2596

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
2KB

MD5
533e371901fe519d3b1cabd61b7d21c1

SHA1
4c4c495f9b0425ae5f086bf7e08cfdd3ec0c0766

SHA256
3c8278ca910df449b25c8b7b0b32fc6e53be364875bc6d8da09752349796db46

SHA512
4dddcbb6ec3da4946693f6c7e7258da6efc80ce2c5b19d0b8310c3075ba0dc2a1e69af75c3f133bb787ae87f90a1a9cc4c7f7d98ed02165a122f559a03dd6e7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
121eee571a909b5aa491c9f2f1682d8c

SHA1
335d55d81ca4d3fcce21788be0164e532f6082e7

SHA256
f871cd60e8a7c4ae92cd6835ff5a92c74b864398b18a192cd07dfb6a3ff0596c

SHA512
41dcf4c92017c42994fbfb3eed3f47c49a5d9422c96e86858150b4d6671a5d8a138fb38ad0688c926ae2b5016d93db21c4dc4462cc19695109b3fbf88e2b3e02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
813B

MD5
837bebb6b490636b61459f6f06ec07b3

SHA1
14c9fedc5ed295fd5ef9bc21b9bc760789ed0aa4

SHA256
ac8b22660a2bb5f92860f7630961daadf6481226723ddd014f88a812d2cf767b

SHA512
4fef5efa25b9dfa50a88c83b819000ad5f41afb0db18ce5dd11f4a1e287f9884b1ff003df02a4b5b2a7879dcab141bd260a49995d28cc089aab8b28aede34930

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
412f5cee3318ee24a2bfce3dbb969c87

SHA1
54f977441e89fc84b8bdb82cab95aed8dd21c7d9

SHA256
ba71500c290b194448e367bf55a71885a3c55780bcc916cd5e6a3dd43a50044d

SHA512
43369c1041ab98d851436fede75c752800a6afe7b9466fbf166c652a941f8212dac87eecd630e01d348fbe0698a85be1100199ff0b4aeb420602eee1b5b0dc52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
00c0b37c1ab46df2d50dccbf4aa71ebe

SHA1
4efb5ac00be0e5c249a2b390c63645bafa715356

SHA256
432ead67c664577f7a566792cbd07e25612d566349ddfb777044781ec70b8231

SHA512
8939b4b5bbacac2cddbf0b610b0bd7148e82595238962c169561325188b73630d2c93059d88fa775a0434560c8783abd1fda3fcf44e1eb73eccfdb4b8fc9dd07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8666cf09c9562944596e955cb975cf76

SHA1
aa7ca8c9cb29cfff1e45bebf3217de125744cb6c

SHA256
7b266d27950b7e30a4345a6de3e4dce4a86b20f4914f0a8ba0874535adc83892

SHA512
75f28513dbf1ca8cb621a8cd48c4b7a967cfdc7163dfa08ceea70c7317d67a6343cdf766b22e9070176ceccfbbf76edce1e0d1a30787292f3c0bf76339838f29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5a43b2628578f5dfdea6a277cc490c6c

SHA1
0e1238d9f140f6fe942918f0dabd5fdddcd511fd

SHA256
2b027bbc601a4ecaa0599786a6701d134b8f4fb9d195194564f244102a680407

SHA512
44c153a54be508b99f2295de572ff32ad255f43207fd25b77f5b68af5d9193d93578455c07298106c2a0899dcd09c95da6d0d13943edad82a7ffe8fd6583a416

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d0fd60085c052801cedca0d7f029bb49

SHA1
c1d02edda71240e2a12ca83d87141f10f4ed083c

SHA256
61e46f9c69ab3dca299456c3ba4d6aa3dc3001bd3cff206cd48e130e35e6716e

SHA512
9925e764508f92362f02d245797531c7df5d46648c77b4ddd1610fcb26a86cbb4f1d3cf63d807650ebffca8055baa64ed473af809a1a6f8d610e45e6a5b58561

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f19a79149b8d5c3f050713a52a11a705

SHA1
89995c9b81c0159b7712e98f609f001a724c5f93

SHA256
0fb4347ae29dcbc2cf7f3c9b2c97846f3297903f75a125615c892ece172077b7

SHA512
b5f74db2a71d1cb6ee93cc2b4d46e2e8f6ee9a28d232fe97e8930e594718bfb72ff3f95f5689b60721d4952d6f5862af221fe657dd54ca59663a98fbef6c195f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b323a0e75b958beab3e242f36bd61ebb

SHA1
e500d437ce7fa28c01cc2d4f77ef69050f2ee5ed

SHA256
22061e4369bfda6b2567d379398135d67a91cc8759ccc8a27290f456383e0151

SHA512
27b6d32310c79d85965d537c3fb6224ed7178d2a9a4c7be96ff4e6d6af21699effb4f8cee176268d60f152b01430a8a430b23fbeb90562cbcedafdf4cdc2e5e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
daf67bede19f6b034180b469aec39b56

SHA1
2225c818bc2dfcb08680c753d8753f8e21d04711

SHA256
3271834975a2ef9a3c2733e38caed20d41e5e6506a87547ac357c3c17d3a0436

SHA512
dfe7ebba7aa8a601b2a69fe5affdc51b0964584575625452a8a22acc772849a86bee289a83317f0f5ee01de15f702c41b6967f3ba74b319f7ec9a36daba6f7c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fcb4145e88a89002eea422fb42449be2

SHA1
02c6f919b977faff10c3ef5a77453fc4bec6acb7

SHA256
4c9d6ae92a1eeac6ca0e20f08c5ea4fa822b3eddc3beb76c3e855e0cc135d430

SHA512
94305d5644ee4cb88eea21220baf41564acfacad9ae338ff7cd450882a4162b6c3ddd4698d90f85daf3b6e56d5f842fa37371b5341a234d5769e597c03dcd2a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ffa16a096924e8d76d04e864bab14dc9

SHA1
4fd62c3d45bf5dba44e4d7fe954f14d97d9fe272

SHA256
f2f5026d077083d6096d4cc7469fc56babfde74c4df1b07fb605df5578bd4195

SHA512
cb1224b4d4e499c3a535e74db208b5ff633acfe43a92cd234744be085a4ae7cc034333e83e4a0d64d8e925d89db67c1f4ad9b643fc44e112ed49a65f69ca7498

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
99e96a8b645b4f3cb7992a8e36ffc605

SHA1
252ea5e95c83ccd12caa0dff2a2c1ae8f3408c19

SHA256
4976d4ee003d64de99b8d16c6bfcf1016c5c106bc2da18aed69dc863d40b9bfa

SHA512
764c83f9ef2cee7699da7abcc01f444e7b21f2932987ce433b7c49b513c873d7a2cf96138e1c82e102230be203304e3cb579ae0d73fe76ad3b8d6a335c051115

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
98830ea7de59779e76ad3c022992f307

SHA1
2566c46d600b025e427870963cecdbddec0d1f89

SHA256
a159f503e2f15f38b9a24cdf9495d73711a5701dab32804fef830bc94e1f148e

SHA512
d6c538d6a2a158f8fdbf1ee24fab9f2d7b5d31ccc8bbfac9a0e7a3dafe5872f25130451e31a9e85cc3edb1aa0be02f6780266945fab6eec3449a685cfe27cd40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c3b6b56e16015e3842b1077cadcb3a37

SHA1
867fc29f6ffc823f24a0b14740e8fa0a780bcac8

SHA256
2949ddbc0625f0421e1caec804fac59318ba9ba8d50a7823b335cfdaba262eef

SHA512
2fdd0f8ca9f312e007b66a347fa7984d58e8bbb80bd603b8feb85d0af11404b712ce5491ea9dfaf8403f930fdd694c5c1fc8be8f2f5ea96ded85d2cc6d2f3d50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57fafa.TMP

Filesize
204B

MD5
024bb0d243004587c96148647132784f

SHA1
808f6c6e6d469faaeece7d3e2006cff507b7d3cc

SHA256
d545012e8b324e4a5d136d2189b5beadbcadb51468d6a295998b06c8e7e258d7

SHA512
5230ed73e8a0b2bfc0d158ae5aab10a41712f227354e31c1dd5eb131e153cb9eba0cb308dec7d64c992863b625ea13e14ff580a64a496994fd21c2d1892c536d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6b584d7d60bdb0c25b1effafc5a98c5f

SHA1
13d1d2ae3a52eb30ea8f3c186bac5ee063bac912

SHA256
34fb9e4ce986237e169f2475c202743f2a42db44aa4442c61eb6390ba5004de2

SHA512
4529b1c358ef12f472fd497e5a8776fecee168bcce72dd7b2f3730023092e722122540cd3e360816a77eb92a13b297ad4ede3adbf304bb5ddb13d164a413212e

Download Submit